We Keep Coding

Configuration file - encrypting connection string

I'm trying to develop a C# Winform application, which connects to SQL database.
So far I was able to move the most sensitive data from my XML configuration file to an external XML configuration file, but that's it.
The last thing I have to do is to encrypt that file, as many people will have access to a directory in which application is located.
My main [APP] configuration file looks as follows:
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<configSections>
</configSections>
<connectionStrings configSource="conn_string.config"/>
<startup>
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.7.2" />
</startup>
</configuration>
And there is my [conn_string] external configuration file in which I'm trying to hide a connection string:
<?xml version="1.0" encoding="utf-8" ?>
<connectionStrings>
<add name="myConnectionStringName"
providerName="System.Data.SqlClient"
connectionString="Data Source=ServerName;Initial
Catalog=InitialDatabaseName;User=UserName;Password=MyPassword;Application Name=MyAppName" />
</connectionStrings>
Now when it comes to encryption I have read that asp-netregiis.exe is looking only for file named "web"
so I temporarily renamed my "conn_string" file to "web"
And tried the encryption(via developer command line VS):
aspnet_regiis -pef "connectionStrings" "path_to_my_conn_string_file"
The result is: ~My translation
The web.config file doesn't contain a configuration tag
So I added one like this:
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<connectionStrings>
<add name="myConnectionStringName"
providerName="System.Data.SqlClient"
connectionString="Data Source=ServerName;Initial
Catalog=InitialDatabaseName;User=UserName;Password=MyPassword;Application Name=MyAppName" />
</connectionStrings>
</configuration>
Now it complains about: ~Again my translation
File format configSource must be an element conatining section name

The steps you are taking that use aspnet_Regiis are really intended for web applications hosted in Internet Information Server (IIS). The file it is looking for is really "web.config." You mentioned that the app being constructed is a winforms application, which isn't a web application. Regular winforms applications are generally configured via a file called "app.config." Visual Studio may have created a base app.config for you depending on the version you're using.
You can "trick" aspnet_Regiis into encrypting your configuration file by temporarily renaming app.config to web.config, and then invoking aspnet_regiis with a flag that points to the exact path of our "phony" web.config:
For simplicity, let's say your initial app.config resides in c:\MyPrograms\MyApp.
Rename app.config to web.config.
From an administrative command prompt, set your current directory to c:\windows\micrsoft.net\framework\v4.0.30319
Invoke aspnet_regiis, using the "-pef" switch to instruct the tool to encrypt a particular section of your web.config:
aspnet_regiis -pef "connectionStrings" c:\MyPrograms\MyApp
If you see a "Succeeded" message, rename your web.config back to app.config, and run your application. .NET should decrypt your connection string automatically at runtime on that machine.
If you need to put this application on other machines, you may need to consider setting up a common encryption key that can be installed on other machines as well as define a provider in web.config that leverages that key. But for now, let's get the basic process working locally, and then worry about the other components once we know this part is working.
Hope this helps!

Why my connection string is null

i am accessing store proceudre from sql database but it throws at connection string point:
"Object reference not set"
Code:
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<configSections>
</configSections>
<connectionStrings>
<add name="ConnectionString" connectionString="Data Source=HOME-PC;Initial Catalog=LMS;Integrated Security=True"
providerName="System.Data.SqlClient" />
</connectionStrings>
</configuration>
string conStr = ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString.ToString();
i am using windows forms in c#.net and i am newbie.

From one of your comments, it seems perhaps your connection string is defined in the app.config file of a class library. If that's the case, you'll need to copy the connection string entry in the config file to the configuration file of the actual application - in this case, the Windows Forms application that is calling the business layer library.

I found two possible solutions:
A. Removing the providerName="System.Data.SqlClient" part from the connection string definition on the App.config file
or
B. Adding a "using System.Data.SqlClient;" line on the using section of the client code where you are attempting to get and use connectionString, like this:
using System.Data.SqlClient;
//(...other code...)
string conStr = ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString.ToString();
My guess is that the use of the providerName option on the connectionstring forces a call to the specified provider on execution.

app.config file C# winforms preserve the connection string

I have an app.config file in Winforms application that holds a connection string. This is to go out to multiple tenant (clients) as a separate file. These clients have different database sources. This config file also holds other version information such as EF, Telerik reporting etc...
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5.1" />
and
<section name="Telerik.Reporting"
type="Telerik.Reporting.Configuration.ReportingConfigurationSection, Telerik.Reporting, Version=8.1.14.804, Culture=neutral, PublicKeyToken=a9d7983dfcc261be"
allowLocation="true" allowDefinition="Everywhere" />
The problem I have is when we have an updated version of EF or Telerik reporting with our application and we deploy (auto-deploy) this we need to overwrite the app.config file in the client directory to update the versions in the client config file. They then lose their connection setting and I do not want the client to have to go and re-enter it.
My question:
Is there a best practice to overcome this issue? Should I hold the connection string somewhere else?

Yep, the best thing to do is to move your connection strings section to an another config file and reference that file within your app.config.
For example create a new file called connectionStrings.config:
<connectionStrings>
<add name="Default" connectionString="[client_connection_string] "/>
</connectionStrings>
And in your app.config file:
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<connectionStrings configSource="connectionStrings.config" />
</configuration>
A full example can be found here.

Use an external configuration file that is referenced from the application config file. E.g. include this section in your config file.
<configuration>
<connectionStrings configSource="connections.config"/>
</configuration>
The external config file is described http://msdn.microsoft.com/en-us/library/ms254494(v=vs.110).aspx
Note that storing connection settings in plaintext on a workstation is still a bad idea.
Using Windows registry for stuff like this is a definite no-no these days.

you can try to hold all connection data that you need in separate xml file so it dont get overwrite when you preform a deploy of updated version.

Connection to database not created after setup created

I had developed C# application. and used external tool for themes.
Before creating setup for this application it works fine. and no problem in database connection.
But after creating setup for this application and installing it, connection to database not created.
I have used app.config file for getting connection string. Am I missing something when creating setup or the problem due to external theme?
My app.config code
<?xml version="1.0" encoding="utf-8" ?>
<configuration> <connectionStrings>
<add name="connectionStrings" connectionString="Data Source=SUMEET-PC\SQLSERVERNEW; Initial Catalog=ClothShop;User Id=sa;Password=123;" />
</connectionStrings>
</configuration>

How do I ensure that the right app.config is being loaded?

I have a console app, let's call it Test.Console. This app uses a project called Test.Code.
Test.Code is a wrapper to access a database and should have an app.config file containing the connection string.
Test.Console should then access the classes in Test.Code to access what's in the database.
However, when I put the connection string in the app.config in the Code project, it doesn't seem to be able to access it, but when I put it in app.config in the Console project, the code in the Code project seems to be able to access it.
Is there any way that I can put the connection string in the Code project rather than the Console project?
Edit:
App.config:
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<connectionStrings>
<clear />
<add name="ACE" connectionString="data source=servername;database=ACE;userid=username;password=password"/>
</connectionStrings>
</configuration>
In my class:
string connection = ConfigurationManager.ConnectionStrings["ACE"].ConnectionString;
That's it at the moment.

The app.config is exactly that, configuration for the running application.
The running application should be in charge of what databases etc that it connects to, hence the reason the config goes there.